1. Home
  2. CVE Database
  3. CVE-2016-10539
HIGH · 7.5

CVE-2016-10539

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier...

Vulnerability Description

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
Negotiator ProjectNegotiator<= 0.6.0

Related Weaknesses (CWE)

CWE-20CWE-400

References

FAQ

What is CVE-2016-10539?

CVE-2016-10539 is a vulnerability with a CVSS score of 7.5 (HIGH). negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier...

How severe is CVE-2016-10539?

CVE-2016-10539 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-10539?

Check the references section above for vendor advisories and patch information. Affected products include: Negotiator Project Negotiator.